Trust Centre
Welcome to the Esri UK and Esri Ireland Trust Centre
Our commitment to information security and data privacy is embedded in every part of our business. Use this Trust Centre to learn about our security posture and request access to our security documentation.
We have established an Integrated Management System (IMS) that complies with ISO/IEC 27001:2022 (as well as BS EN ISO 9001:2015, BS EN ISO 14001:2015) standards.
A full list of Esri UK and Esri Ireland policies, and other relevant information, can be found in this Trust Centre.
Note: The scope of this Trust Centre is Esri UK and Esri Ireland, covering our back office systems and organisational approaches to information and data security. This Trust Centre does not cover Esri Inc or a detailed insight into Esri Inc ArcGIS products. A useful starting point to understand the relationship between Esri UK/Esri Ireland and Esri Inc can be found here in the Trust Centre.
The Esri Inc ArcGIS Trust Centre can be found here
Trust Centre Updates
Recent Critical Vulnerabilities Affecting Third-Party Software Components
Update - 29 October 2026
We are aware of the recently disclosed Brotli decoder vulnerability (CVE-2026-111497) and are currently assessing its applicability to Esri UK and Esri Ireland systems and services.
We are reviewing vendor guidance, identifying any potentially affected components, and evaluating available remediation actions where required.
CVE-2026-111497:
Sweet for ArcGIS Enterprise, UNE for ArcGIS
While Sweet for ArcGIS Enterprise and UNE for ArcGIS include an optional server component that can be deployed on the affected versions of Node.js, they are not susceptible to CVE-2026-111497 however as Node.JS is a system wide component we strongly recommend that you upgrade to the latest node LTS versions >= 22.23.4 or 24.22.1
Sweet for ArcGIS Online
This hosted Esri UK Product is hosted on infrastructure that has been patched to address this issue. No customer action is required.
We will continue to monitor the situation and provide further updates as our assessment progresses.
For information relating to Esri products and services, please refer to the Esri advisory notice here
Following the disclosure of recent PHP vulnerabilities, we have reviewed all relevant Esri UK Products and environments and applied the appropriate remediation actions where required
Our use of PHP is extremely limited, and we have found no evidence that any Esri UK or Esri Ireland systems or services have been compromised as a result of these vulnerabilities.
We will continue to monitor the situation and apply any further actions as required.
For information relating to Esri products and services, please refer to the Esri advisory notice here
